task: capture SYCL sources in the Coverity scan

.github/workflows/coverity.yml

@@ -28,6 +28,7 @@ jobs:
         with:
           # versioneer needs the tags to compute the package version
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Add Intel repository
         run: |
@@ -79,33 +80,57 @@ jobs:
           echo "${PWD}/cov-analysis/bin" >> "$GITHUB_PATH"
 
       - name: Configure Coverity for the DPC++ compiler
-        env:
-          # icx/icpx are not in Coverity's list of known compilers, so the
-          # clang-based templates below have to be accepted explicitly
-          COVERITY_UNSUPPORTED: 1
         run: |
           source "${ONEAPI_ROOT}/setvars.sh"
-          # Cython-generated sources and the pybind11 extensions go through
-          # icpx, the sysroot/driver probing bits still use gcc
           cov-configure --gcc
-          cov-configure --template --comptype clangcc --compiler icx
-          cov-configure --template --comptype clangcxx --compiler icpx
+          # Generic clang templates can't parse SYCL headers, see https://github.com/IntelPython/dpctl/pull/2401
+          comptypes="$(cov-configure --list-compiler-types | cut -d, -f1)"
+          comptype=""
+          for candidate in intel_oneapi_icx intel_oneapi_icx:linux intel_icx:linux; do
+            if grep -qxF "${candidate}" <<< "${comptypes}"; then
+              comptype="${candidate}"
+              break
+            fi
+          done
+          if [ -z "${comptype}" ]; then
+            echo "::error::No Intel oneAPI compiler type in this cov-analysis; refusing to fall back to the generic Clang configuration."
+            exit 1
+          fi
+          echo "Using Coverity compiler type: ${comptype}"
+          cov-configure --template --comptype "${comptype}" --compiler icx
+          cov-configure --template --comptype "${comptype}" --compiler icpx
 
       - name: Build under cov-build
         timeout-minutes: 90
-        env:
-          COVERITY_UNSUPPORTED: 1
         run: |
           set -o pipefail
           source "${ONEAPI_ROOT}/setvars.sh"
-          rm -rf _skbuild
-          # --skip-editable: the in-place build_ext already compiled everything
-          # Coverity needs to see, a pip install would only repeat it
+          # --skip-editable: build_ext --inplace already compiled everything
           cov-build --dir cov-int \
               python scripts/build_locally.py --oneapi --skip-editable --verbose \
               2>&1 | tee cov-build.log
-          if ! grep -qE "Emitted [1-9][0-9]* .*compilation unit" cov-build.log; then
-            echo "::error::Coverity captured 0 compilation units — the C++ build did not run under cov-build."
+          {
+            echo "### Coverity capture"
+            echo '```'
+            grep -E "Emitted .*compilation unit|are ready for analysis" cov-build.log || true
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+          # Gate on per-source emits, not the P% total, see https://github.com/IntelPython/dpctl/pull/2401
+          log=cov-int/build-log.txt
+          compiled="$(grep -oP '\[STATUS\] Compiling \K\S+' "${log}" | grep -F "${GITHUB_WORKSPACE}/" | grep -vF /CMakeFiles/ | sort -u || true)"
+          # Unanchored: parallel compiles can splice output onto the same log line
+          emitted="$(grep -oP "Emit for file '\K[^']+(?=' \(TU [0-9]+\) complete\.)" "${log}" | sort -u || true)"
+          missing="$(comm -23 <(echo "${compiled}") <(echo "${emitted}"))"
+          total="$(grep -c . <<< "${compiled}" || true)"
+          nmissing="$(grep -c . <<< "${missing}" || true)"
+          echo "Coverity emitted $(( total - nmissing )) of ${total} project sources" | tee -a "$GITHUB_STEP_SUMMARY"
+          if [ "${total}" -eq 0 ]; then
+            echo "::error::No project sources were compiled under cov-build."
+            exit 1
+          fi
+          if [ "${nmissing}" -gt 0 ]; then
+            echo "${missing}"
+            echo "::error::Coverity did not emit ${nmissing} of ${total} project sources (listed above)."
             exit 1
           fi
 
@@ -121,6 +146,8 @@ jobs:
           if-no-files-found: warn
 
       - name: Submit results to Coverity Scan
+        # A branch submit would replace master's results on the Scan dashboard
+        if: github.ref == 'refs/heads/master'
         timeout-minutes: 15
         env:
           COVERITY_SCAN_TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}